MDEV-40578 - Additional crash analysis
========================================

Full literal query text at each crash (untruncated):

Crash 1 (11.8.8): SELECT `product_srl`, `member_srl`, `product_category`,
`product_price`, `use_amount`, `valid_deadline`, `product_name`,
`sale_item`, `user_setting`, `restoration`, `item_condition`,
`apply_date`, `regdate`, `possess_amount` FROM `itemshop_transaction`
AS `itemshop_transaction` WHERE `member_srl` = '87654321'

Crash 2 (12.3.2): SELECT * FROM `document_extra_vars` AS `extra_vars`
WHERE `extra_vars`.`document_srl` IN ('12345678') AND
`extra_vars`.`var_idx` >= '-2'

Note: this crash 1 query is notable because it uses an explicit column list
(not SELECT *) - shows the bug isn't limited to SELECT * queries.

This file contains full backtraces (thread apply, all local variables) for
these two separate crash instances, analyzed with matching debuginfo:

1. MariaDB 11.8.8 - crash in JOIN::free_pushdown_handlers()
2. MariaDB 12.3.2 - crash in get_sargable_cond() / JOIN::optimize_inner

Database/table name prefix and specific row ID values have been redacted
for privacy (production data). Table names themselves (documents,
document_extra_vars, itemshop_transaction, etc.) are unchanged since they
are standard open-source Rhymix CMS table names, not sensitive.

========================================
CRASH 1: MariaDB 11.8.8 - JOIN::free_pushdown_handlers()
========================================


Database/table name prefix and specific row ID values have been redacted
for privacy (production data). Table names themselves (documents,
document_extra_vars, itemshop_transaction, etc.) are unchanged since they
are standard open-source Rhymix CMS table names, not sensitive.

========================================
CRASH 1: MariaDB 11.8.8 - JOIN::free_pushdown_handlers()
========================================

warning: Can't open file (null) during file-backed mapping note processing
warning: Can't open file (null) during file-backed mapping note processing
[New LWP 155214]
[New LWP 155219]
[New LWP 155218]
[New LWP 155217]
[New LWP 155725]
[New LWP 160467]
[New LWP 155256]
[New LWP 160703]
[New LWP 155257]
[New LWP 159637]
[New LWP 160526]
[New LWP 155216]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/mariadbd'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007faef4a890ef in select () from /lib64/libc.so.6
[Current thread is 1 (Thread 0x7faef7028a00 (LWP 155214))]
[Switching to thread 5 (Thread 0x77aea1985700 (LWP 155725))]
#0  JOIN::free_pushdown_handlers (this=this@entry=0x77adf0016048, join_list=...) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:17295
warning: Source file is more recent than executable.
17295	
#0  JOIN::free_pushdown_handlers (this=this@entry=0x77adf0016048, join_list=...) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:17295
        li = <optimized out>
        table_ref = 0x77adf0014b88
#1  0x000055945cb6c4fb in JOIN::cleanup (this=0x77adf0016048, full=full@entry=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:17262
No locals.
#2  0x000055945cb6c9ac in JOIN::join_free (this=this@entry=0x77adf0016048) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:17088
        tmp_unit = <optimized out>
        sl = <optimized out>
        full = true
        can_unlock = true
#3  0x000055945cb75aec in do_select (procedure=<optimized out>, join=0x77adf0016048) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:23950
        rc = <optimized out>
        error = <optimized out>
        top_level_tables = <optimized out>
        rc = <optimized out>
        error = <optimized out>
        top_level_tables = <optimized out>
        res = <optimized out>
        last_tab = <optimized out>
        state = <optimized out>
        end_select = <optimized out>
        cleared_tables = <optimized out>
        columns_list = <optimized out>
        join_tab = <optimized out>
        sort_tab = <optimized out>
        join_tab = <optimized out>
        const_tables = <optimized out>
#4  JOIN::exec_inner (this=0x77adf0016048) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:5112
        columns_list = <optimized out>
#5  0x000055945cb75ebe in JOIN::exec (this=this@entry=0x77adf0016048) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:4900
        res = <optimized out>
#6  0x000055945cb7423e in mysql_select (thd=0x77adf0000c58, tables=0x77adf0014b88, fields=..., conds=0x77adf00154c0, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x77adf0016020, unit=0x77adf0004fd8, select_lex=0x77adf00131e8) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:5426
        err = 0
        free_join = true
        exec_error = false
        join = 0x77adf0016048
#7  0x000055945cb74a4e in handle_select (thd=thd@entry=0x77adf0000c58, lex=lex@entry=0x77adf0004ef8, result=result@entry=0x77adf0016020, setup_tables_done_option=setup_tables_done_option@entry=0) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:634
        unit = 0x77adf0004fd8
        res = <optimized out>
        select_lex = 0x77adf00131e8
#8  0x000055945caf0ca1 in execute_sqlcom_select (thd=0x77adf0000c58, all_tables=0x77adf0014b88) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:6232
        save_protocol = 0x0
        lex = 0x77adf0004ef8
        result = 0x77adf0016020
        res = <optimized out>
#9  0x000055945caff232 in mysql_execute_command (thd=0x77adf0000c58, is_called_from_prepared_stmt=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:4014
        res = <optimized out>
        lex = 0x77adf0004ef8
        select_lex = <optimized out>
        first_table = 0x77adf0014b88
        all_tables = 0x77adf0014b88
        unit = 0x77adf0004fd8
        ots = {ctx = 0x77adf0004c60, traceable = false}
        orig_binlog_format = BINLOG_FORMAT_MIXED
        orig_current_stmt_binlog_format = BINLOG_FORMAT_STMT
#10 0x000055945caec4b9 in mysql_parse (thd=0x77adf0000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:7953
        found_semicolon = <optimized out>
        error = <optimized out>
        lex = 0x77adf0004ef8
        err = <optimized out>
#11 0x000055945caf82cb in dispatch_command (command=COM_QUERY, thd=0x77adf0000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_class.h:1683
        packet_end = 0x77adf0013042 ""
        parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x77adf0000c58, m_ptr = 0x77adf0013043 "\t", m_tok_start = 0x77adf0013043 "\t", m_tok_end = 0x77adf0013043 "\t", m_end_of_query = 0x77adf0013042 "", m_tok_start_prev = 0x77adf0013042 "", m_buf = 0x77adf0012f00 "SELECT `product_srl`, `member_srl`, `product_category`, `product_price`, `use_amount`, `valid_deadline`, `product_name`, `sale_item`, `user_setting`, `restoration`, `item_condition`, `apply_date`, `re"..., m_buf_length = 322, m_echo = true, m_echo_saved = false, m_cpp_buf = 0x77adf00130a0 "SELECT `product_srl`, `member_srl`, `product_category`, `product_price`, `use_amount`, `valid_deadline`, `product_name`, `sale_item`, `user_setting`, `restoration`, `item_condition`, `apply_date`, `re"..., m_cpp_ptr = 0x77adf00131e2 "", m_cpp_tok_start = 0x77adf00131e2 "", m_cpp_tok_start_prev = 0x77adf00131e2 "", m_cpp_tok_end = 0x77adf00131e2 "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x0, m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, yylineno = 1, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = NO_COMMENT, m_cpp_text_start = 0x77adf00131d9 "87654321'", m_cpp_text_end = 0x77adf00131e1 "'", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 13 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x0}
        net = 0x77adf0000f18
        error = false
        do_end_of_statement = true
        log_slow_done = false
        __FUNCTION__ = "\000\000\000A\307Fl\000\000\000\000\350 \220j\377I"
        res = <optimized out>
#12 0x000055945cafa291 in do_command (thd=thd@entry=0x77adf0000c58, blocking=blocking@entry=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:1431
        return_value = <optimized out>
        packet = 0x77adf0030758 "\001"
        packet_length = <optimized out>
        net = 0x77adf0000f18
        command = COM_QUERY
        __FUNCTION__ = "\000\000\200I\307F\020\000\000\000"
#13 0x000055945cc23605 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55945f4f79e8, put_in_cache=put_in_cache@entry=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_connect.cc:1504
        create_user = true
        thr_create_utime = <optimized out>
        thd = 0x77adf0000c58
#14 0x000055945cc23965 in handle_one_connection (arg=arg@entry=0x55945f4f79e8) at /usr/src/debug/MariaDB-/src_0/sql/sql_connect.cc:1416
        connect = 0x55945f4f79e8
#15 0x000055945cf7fbaa in pfs_spawn_thread (arg=0x55945f4f7a58) at /usr/src/debug/MariaDB-/src_0/storage/perfschema/pfs.cc:2198
        typed_arg = 0x55945f4f7a58
        user_arg = 0x55945f4f79e8
        user_start_routine = 0x55945cc23900 <handle_one_connection(void*)>
        pfs = <optimized out>
        klass = <optimized out>
#16 0x00007faef58651ca in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#17 0x00007faef498d953 in clone () from /lib64/libc.so.6
No symbol table info available.


========================================
CRASH 2: MariaDB 12.3.2 - get_sargable_cond() / JOIN::optimize_inner
========================================


warning: Can't open file (null) during file-backed mapping note processing
[New LWP 93767]
[New LWP 93770]
[New LWP 93771]
[New LWP 93773]
[New LWP 93775]
[New LWP 93776]
[New LWP 93783]
[New LWP 93782]
[New LWP 93873]
[New LWP 93772]
[New LWP 93769]
[New LWP 93768]
[New LWP 93779]
[New LWP 93845]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/mariadbd'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f626508f0ef in select () from /lib64/libc.so.6
[Current thread is 1 (Thread 0x7f626762ea00 (LWP 93767))]
[Switching to thread 14 (Thread 0x7f624c2f0700 (LWP 93845))]
#0  0x000055de0514e54f in JOIN::optimize_inner (this=0x7761c4015850) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:5635
5635	  return retval;
#0  0x000055de0514e54f in JOIN::optimize_inner (this=0x7761c4015850) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:5635
        prune_cond = <optimized out>
        tbl = <optimized out>
        li = {<base_list_iterator> = {list = <optimized out>, el = 0x7761c4016010, prev = 0x0, current = 0x0}, <No data fields>}
        trace_wrapper = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55de062ba6d0 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_prepare = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55de062ba6d0 <vtable for Json_writer_object+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        trace_steps = {<Json_writer_struct> = {_vptr.Json_writer_struct = 0x55de062ba6f0 <vtable for Json_writer_array+16>, my_writer = 0x0, context = {writer = 0x0}, closed = false}, <No data fields>}
        sel = <optimized out>
        eq_list = {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55de06547e70 <end_of_list>, last = 0x7f624c2ee450, elements = 0}, <No data fields>}
        ignore_on_expr = <optimized out>
        tbl = <optimized out>
        li = {<base_list_iterator> = {list = <optimized out>, el = <optimized out>, prev = 0x0, current = 0x0}, <No data fields>}
#1  0x000055de0514eca6 in JOIN::optimize (this=this@entry=0x7761c4015850) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:2016
        res = 0
#2  0x000055de0514ed9b in mysql_select (thd=0x7761c4000c60, tables=0x7761c4013d30, fields=..., conds=0x7761c4014d80, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x7761c4015820, unit=0x7761c40051b0, select_lex=0x7761c4013610) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:5425
        err = 0
        free_join = true
        exec_error = false
        join = 0x7761c4015850
#3  0x000055de0514f5fe in handle_select (thd=thd@entry=0x7761c4000c60, lex=lex@entry=0x7761c40050d0, result=result@entry=0x7761c4015820, setup_tables_done_option=setup_tables_done_option@entry=0) at /usr/src/debug/MariaDB-/src_0/sql/sql_select.cc:636
        unit = 0x7761c40051b0
        res = <optimized out>
        select_lex = 0x7761c4013610
#4  0x000055de050c7f56 in execute_sqlcom_select (thd=0x7761c4000c60, all_tables=0x7761c4013d30) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:6219
        save_protocol = 0x0
        lex = 0x7761c40050d0
        result = 0x7761c4015820
        res = <optimized out>
#5  0x000055de050d6478 in mysql_execute_command (thd=0x7761c4000c60, is_called_from_prepared_stmt=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:3992
        res = <optimized out>
        lex = 0x7761c40050d0
        select_lex = <optimized out>
        first_table = 0x7761c4013d30
        all_tables = 0x7761c4013d30
        unit = 0x7761c40051b0
        ots = {ctx = 0x7761c4004e38, traceable = false}
        orig_binlog_format = BINLOG_FORMAT_MIXED
        orig_current_stmt_binlog_format = BINLOG_FORMAT_STMT
#6  0x000055de050c2972 in mysql_parse (thd=0x7761c4000c60, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:7947
        found_semicolon = <optimized out>
        error = <optimized out>
        lex = 0x7761c40050d0
        err = <optimized out>
#7  0x000055de050cf5d9 in dispatch_command (command=COM_QUERY, thd=0x7761c4000c60, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /usr/src/debug/MariaDB-/src_0/sql/sql_class.h:1892
        packet_end = 0x7761c4013514 ""
        parser_state = {m_lip = {lookahead_token = -1, lookahead_yylval = 0x0, m_thd = 0x7761c4000c60, m_ptr = 0x7761c4013515 "\t", m_tok_start = 0x7761c4013515 "\t", m_tok_end = 0x7761c4013515 "\t", m_end_of_query = 0x7761c4013514 "", m_tok_start_prev = 0x7761c4013514 "", m_buf = 0x7761c4013480 "SELECT * FROM `document_extra_vars` AS `extra_vars` WHERE `extra_vars`.`document_srl` IN ('12345678') AND `extra_vars`.`var_idx` >= '-2'", m_buf_length = 148, m_echo = true, m_echo_saved = false, m_cpp_buf = 0x7761c4013570 "SELECT * FROM `document_extra_vars` AS `extra_vars` WHERE `extra_vars`.`document_srl` IN ('12345678') AND `extra_vars`.`var_idx` >= '-2'", m_cpp_ptr = 0x7761c4013604 "", m_cpp_tok_start = 0x7761c4013604 "", m_cpp_tok_start_prev = 0x7761c4013604 "", m_cpp_tok_end = 0x7761c4013604 "", m_body_utf8 = 0x0, m_body_utf8_ptr = 0x0, m_cpp_utf8_processed_ptr = 0x0, next_state = MY_LEX_END, found_semicolon = 0x0, ignore_space = false, stmt_prepare_mode = false, multi_statements = true, hint_comment = false, yylineno = 1, m_digest = 0x0, in_comment = NO_COMMENT, in_comment_saved = NO_COMMENT, m_cpp_text_start = 0x7761c4013601 "-2'", m_cpp_text_end = 0x7761c4013603 "'", m_underscore_cs = 0x0}, m_yacc = {yacc_yyss = 0x0, yacc_yyvs = 0x0, m_set_signal_info = {m_item = {0x0 <repeats 13 times>}}, m_lock_type = TL_READ_DEFAULT, m_mdl_type = MDL_SHARED_READ}, m_digest_psi = 0x0}
        net = 0x7761c4000fd8
        error = false
        do_end_of_statement = true
        log_slow_done = false
        __FUNCTION__ = "dispatch_command"
        res = <optimized out>
#8  0x000055de050d1425 in do_command (thd=thd@entry=0x7761c4000c60, blocking=blocking@entry=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_parse.cc:1437
        return_value = <optimized out>
        packet = 0x7761c4008b60 "\003SELECT * FROM `document_extra_vars` AS `extra_vars` WHERE `extra_vars`.`document_srl` IN ('12345678') AND `extra_vars`.`var_idx` >= '-2'"
        packet_length = <optimized out>
        net = 0x7761c4000fd8
        command = COM_QUERY
        __FUNCTION__ = "do_command"
#9  0x000055de052054a5 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55de07f4b9c0, put_in_cache=put_in_cache@entry=true) at /usr/src/debug/MariaDB-/src_0/sql/sql_connect.cc:1503
        create_user = true
        thr_create_utime = <optimized out>
        thd = 0x7761c4000c60
#10 0x000055de05205805 in handle_one_connection (arg=arg@entry=0x55de07f4b9c0) at /usr/src/debug/MariaDB-/src_0/sql/sql_connect.cc:1415
        connect = 0x55de07f4b9c0
#11 0x000055de055a47ea in pfs_spawn_thread (arg=0x55de07f4ba30) at /usr/src/debug/MariaDB-/src_0/storage/perfschema/pfs.cc:2198
        typed_arg = 0x55de07f4ba30
        user_arg = 0x55de07f4b9c0
        user_start_routine = 0x55de052057a0 <handle_one_connection(void*)>
        pfs = <optimized out>
        klass = <optimized out>
#12 0x00007f6265e6b1ca in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#13 0x00007f6264f93953 in clone () from /lib64/libc.so.6
No symbol table info available.